mz-deploy
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent on how to use the
mz-deployCLI to manage the deployment lifecycle of SQL projects. Evidence includes documented commands for staging, promoting, and applying SQL changes to Materialize environments. - [CREDENTIALS_UNSAFE]: The skill describes managing database connection profiles via
profiles.tomland~/.mz. It follows security best practices by recommending environment variable substitution for password management instead of hardcoding secrets. - [EXTERNAL_DOWNLOADS]: Installation instructions point to the official vendor repository for the CLI tool. The command
brew install materializeinc/materialize/mz-deploytargets a trusted source. - [PRIVILEGE_ESCALATION]: The skill documents that the
mz-deploy setupcommand requires superuser privileges during initial configuration to establish necessary database roles and grant system privileges when Role-Based Access Control (RBAC) is enabled. - [DYNAMIC_EXECUTION]: The
testandexplaincommands utilize Docker to run SQL validation and unit tests within an isolated container environment namedmz-deploy-sandbox.
Audit Metadata